New Mexico Administrative Code

The purpose of this policy is to provide state of New Mexico staff with guidance on the proper use of the state's information technology resources, including but not limited to the internet, the intranet, email, and the state's digital network and supporting systems.

As used in this policy: A. access means the ability to read, change, or enter data using a computer or an information system; B. equipment means computers, monitors, keyboards, mice, routers, switches, hubs, networks, or any other information technology assets; C. freeware or sha…

The internet and other information technology resources are important assets that the state can use to gather information to improve external and internal communications and increase efficiency in business relationships. To encourage the effective and appropriate use of the state…

State IT resources shall not be used for anything other than official state business unless otherwise specifically allowed by the agency head or as permitted under Section 1.12.10.10 NMAC. A. No software licensed to the state nor data owned or licensed by the state shall be uploa…

Information Technology Commission, 404 Montezuma, Santa Fe, NM 87501.

IP addressing. A. The enterprise service provider will assign, document, and manage all address blocks of private, public, and reserved address spaces. B. Agencies will manage and control all addresses within their block. Agencies will be required to submit current and accurate I…

Password policy. A. This policy establishes a standard for creation of strong passwords, the protection of those passwords, and the frequency of change. B. Passwords must be at least eight (8) alphanumeric characters long. C. All system-level passwords (e.g., root, enable, NT adm…

This rule applies to the enterprise architecture of the state of New Mexico (SoNM) and all IT projects or programs undertaken by agencies. This rule applies to any state government body or public entity that would like to become a member or utilize services within the enterprise …

NMSA 1978 Section 15-1C-5 and 15-1C-8.

Permanent.

The effective date is 06-15-2005, unless a later date is specified at the end of a section.

The purpose of this document is to establish rules, standards, and policies for the enterprise architecture for the SoNM.

As used in this policy. A. Address block means a contiguous group of internet protocol (IP) addresses. B. Addressing resolution means a method for resolving differences between computer addressing schemes. Address resolution usually specifies a method for mapping network layer (l…

A.ARIN means American registry for internet numbers B. ARP means address resolution protocol C.CIO means chief information officer D.EA means enterprise architecture E. IETF means internet engineering task force F.IP means means internet protocol G.IPSec means IP security H. Ipv4…

Information Technology Commission.

This rule applies to extended sourcing technology by executive agencies.

Sections 15-1C-5 and 15-1C-8 NMSA, 1978.

Permanent.

October 17, 2005, unless a later date is cited at the end of a section.

The purpose of this rule is to select enterprise-wide programs, applications, and application systems that do not inhibit or create barriers to necessary interaction, collaboration and information sharing among governmental agencies.

A. "Application" means the software, including code and processes that address specific business needs; separate from the operating system software. B. "Commercial off the shelf (COTS)" means commercially available software designed to meet specific business needs and generally m…

When selecting software, the following principles apply. A. The user base of the particular "sourced" application is growing, commercial interest and support is evident and a certified peer support group is active. B. Source code and application platforms are well supported and b…

Information Technology Commission.

The commission may appoint committees from time to time and may abolish them at any time. Committees shall have investigative or advisory powers only, reporting all findings and recommendations to the commission for action. The commission shall assign specific topics for study or…

The office shall serve as staff to the commission and shall: A. prepare, file and post all notices of meetings; B. prepare the agenda for meetings; the agenda for regular meetings shall include at a minimum a call to order, roll call, approval of agenda and minutes, presentation …

A. Regular meetings. The chairperson shall call a regular meeting of the commission not less often than semiannually. The office shall provide notice to the public of the date, time, and place of regular meetings by publication once in a newspaper of general circulation in the st…

A. Proposed rules. Any person may submit a proposal for a rule to the commission. The office shall evaluate the proposal for compliance with the state information architecture and the state strategic plan and shall report its findings and recommendations to the commission. The co…

A. Proposed guidelines. Any person may submit a proposal for a guideline to the commission. The office shall evaluate the proposal for compliance with the state information architecture and the state strategic plan and shall report its findings and recommendations to the commissi…

A. State information technology strategic plan. On or before June 1 of each year, the commission shall update the state information technology strategic plan. B. Information technology planning guidelines. On or before June 1 of each year, the commission shall provide information…

This rule applies to all actions taken by the information technology commission.

NMSA 1978 Section 15-1C-5.

Permanent.

February 1, 2000, unless a later date is cited at the end of a section or paragraph.

The purpose of this rule is to establish the procedures by which the commission will operate in carrying out its responsibilities under the Act.

As used in this rule: A. "advisory member" means a person appointed to the commission pursuant to NMSA 1978 Section 15-1C-4 B; B. "comment draft" means the draft of a proposed rule or guideline approved by the Commission for publication for the limited purpose of receiving commen…

A. Terms. Public members shall serve for staggered three-year terms or until they resign. All other members shall serve until they resign or are replaced by their appointing authority. B. Vacancies. A member may resign or a member's position on the commission may be deemed vacant…

A. Chairperson. The chairperson shall preside at meetings of the commission and shall assume all duties designated from time to time by the commission. B. Vice-chairperson. The vice-chairperson shall perform the duties and assume the obligations of the chairperson when the chairp…

Department of Information Technology.

All agencies shall implement a range of network controls to maintain security in its trusted, internal network, and to ensure the protection of connected services and networks. Such controls help prevent unauthorized access and use of the agencies' private networks. The following…

The issuance and use of privileged accounts in agencies shall be restricted and controlled by system administrator management in the agency. A. Agencies shall develop processes to ensure that if a privilege account is issued, the use of such privileged accounts is monitored by th…

To preserve the integrity, confidentiality, and availability of the system and the data, the agency's information assets shall be protected by logical as well as physical access control mechanisms commensurate with the value and sensitivity of the system, the ease of recovery of …

A. Access to agency operating system code, commands and services shall be restricted to individuals with specialized skills such as systems programmers, database administrators, network, and security administrators who require access to perform their daily job responsibilities. (…

A. Access to agency business and systems applications shall be restricted to those individuals who have an identified business need to access those applications or systems in the performance of their job responsibilities. B. Access to source code for applications and systems shal…

Access to an agency's trusted internal network shall require all agency authorized users to authenticate themselves through use of an individually assigned user ID or other agency approved authentication mechanism (e.g., password, token, smart card). Network controls shall be dev…

A. To maintain information security, agency must require through published policies and procedures consistent with these rules, that individual accountability shall be maintained at all times, including during remote access. B. Connection to the agency's networks shall be provide…

A. The internet is inherently insecure, access to the internet is prohibited from any device that is connected (wired or wireless) to any part of the state network unless such access is authorized via exception signed by the state CIO. Such access includes accounts with third-par…